Security is a major concern among operators of computer networks. Attacks upon computer networks can disrupt the service of the computer network and can potentially expose proprietary data to such persons committing attacks.
Network security products such as intrusion detection systems (ID systems) can use a passive filtering technique to detect policy violations and/or patterns of misuse that indicate an attack is occurring or is imminent. The passive filtering technique usually comprises monitoring traffic upon or outside of the computer network for packets of data and comparing these packets of data with known “attack signatures.”
Some conventional ID systems use a string matching algorithm as a passive filtering technique. A string-matching algorithm takes a string of characters from the input stream and compares the string of characters to known attack signatures. For example, some conventional ID systems can use a UNIX-based regular expression (REGEX) engine to search through an input stream for character strings that match an attack signature. In such a system, first the input stream is buffered. The buffer is compared to the REGEX command which searches through the entire buffer in order to find a match. If a match is found, indicating an attack, an alarm is sounded or preventative measures are taken.
There are several disadvantages with such a conventional ID system. For example, excessive memory and CPU resources are required during buffer manipulation. Furthermore, it may be necessary to examine individual characters in the data buffer several times in order to find a valid match. Furthermore, as data traffic increases such problems lead to the possibility of dropping packets, resulting in a potential failure to detect an attack.
An additional complicating factor is that for some attacks, there can be a large amount of irrelevant data between strings of relevant data. As a result, these conventional systems can require the buffering of large portions of the input stream, and it can be necessary to search portions of these buffered portions multiple times. Furthermore, it can be possible for an attack to cross a buffer boundary, leading to the possibility of missing the attack.